Insider 2018-12: 3.19 release; optimizing Splunk; Python source; HTTP batch;

Dear syslog-ng users,

This is the 71st issue of syslog-ng Insider, a monthly newsletter that brings you syslog-ng-related news.


Version 3.19 of syslog-ng released

Version 3.19 of syslog-ng has been released with plenty of new features and bugfixes. Performance of the HTTP destination improved thanks to load-balancing to multiple servers. You can use this to send the messages to a set of ingestion nodes or indexers of your SIEM solution if a single node cannot handle the load. The new Slack destination allows you to send alerts to a Slack channel.

Read the complete list of changes at

Optimize your Splunk infrastructure using new syslog-ng features

Learn how to use less resources for better performance in Splunk! Many people have been using syslog-ng for decades without knowing that it receives new features as well as bugfixes. While many Linux utilities are practically in maintenance mode, syslog-ng keeps evolving constantly. A strong focus in recent years has been on message parsing and destination drivers.

After my talk at Suricon, Splunk users explained how they will change their syslog-ng configurations to optimize their Splunk infrastructure.

Python source in syslog-ng

Using syslog-ng 3.18 and newer releases, you can write new source drivers for syslog-ng in Python. While performance is not as good as C, you gain flexibility and ease of implementation. There are quite a few log sources without a ready to use C API, but with a Python API. Using the Python source of syslog-ng you can leverage these.

Bulk mode message sending to Elasticsearch with syslog-ng http() destination

Learn how to send log messages in bulk mode to your Elasticsearch server with syslog-ng. Bulk mode offers better performance, because it sends multiple log messages in a single POST request.


You can watch our past webinars:

Your feedback and news, or tips about the next issue are welcome.